This update for openssl-3 fixes the following issues: CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update of bluez fixes the following issue: The bluez-deprecated package is shipped again, as it contains some tools still in common use. (bsc#1217251)

This update for openvswitch3 fixes the following issues: CVE-2023-3966: Fixed invalid memory access in Geneve with HW offload (bsc#1219465).

This update for aardvark-dns and netavark fixes the following issues: aardvark-dns was updated to version 1.10.0 (jsc#PED-7577): Changes in version 1.10.0:

chore(deps): update rust crate chrono to 0.4.32

chore(deps): update dependency containers/automationimages to v20240102 fix(deps): update rust crate futures-util to 0.3.30 fix(deps): update rust crate anyhow to 1.0.79 fix(deps): update rust crate tokio to 1.35.1 chore(deps): update dependency containers/automationimages to v20231208 fix(deps): update rust crate tokio to 1.35.0 fix duplicated IP CI flake server: remove unused kill switch

fix(deps): update rust crate clap to ~4.4.10

Changes in version 1.9.0:

run cargo update

chore(deps): update dependency containers/automationimages to v20231116 fix(deps): update rust crate tokio to 1.34.0 fix(deps): update rust crate async-broadcast to 0.6.0 update trust-dns to hickory fix(deps): update rust crate futures-util to 0.3.29 fix(deps): update rust crate trust-dns-server to 0.23.2 fix(deps): update rust crate trust-dns-proto to 0.23.2 tmt: initial enablement aardvark main: change error reporting chore(deps): update dependency containers/automationimages to v20231004 fix(deps): update rust crate trust-dns-proto to 0.23.1 fix(deps): update rust crate trust-dns-client to 0.23.1 clippy: some format fixes

fix(deps): update rust crate tokio to 1.33.0

Changes in version 1.8.0:

run cargo update

Packit: switch to @containers/packit-build team for copr failure notification comments [CI:BUILD] Packit: tag @lsm5 on copr build failures chore(deps): update rust crate chrono to 0.4.31 cargo: bump chrono to 0.4.30 test: IPv6 format is changed in v1.72.0 bump nix to 0.27.1 vendor: bump trustdnsproto and trustdnsclient to 0.23.0 fix(deps): update rust crate trust-dns-server to 0.23.0 [CI:BUILD] rpm: spdx compatible license field fix(deps): update rust crate anyhow to 1.0.75 fix(deps): update rust crate tokio to 1.32.0 chore(deps): update dependency containers/automationimages to v20230816 fix(deps): update rust crate tokio to 1.31.0 fix(deps): update rust crate anyhow to 1.0.74 fix(deps): update rust crate anyhow to 1.0.73 fix(deps): update rust crate log to 0.4.20 chore(deps): update dependency containers/automationimages to v20230809 fix(deps): update rust crate tokio to 1.30.0 fix(deps): update rust crate clap to 4.3.21 packit: Build PRs into default packit COPRs chore(deps): update dependency containers/automationimages to v20230807 fix(deps): update rust crate anyhow to 1.0.72 fix(deps): update rust crate signal-hook to 0.3.17 fix(deps): update rust crate clap to 4.3.19 fix(deps): update rust crate clap to 4.3.15 fix(deps): update rust crate signal-hook to 0.3.16 [CI:BUILD] Packit: remove pre-sync action fix(deps): update rust crate clap to 4.3.11 fix(deps): update rust crate tokio to 1.29.1 fix(deps): update rust crate clap to 4.3.10

[CI:BUILD] RPM: cleanup spec and fix eln builds

Disable restricting builds only for tier1 platforms i.e. only for x8664 and aarch64 and enable for all.

Changes in version 1.7.0:

fix(deps): update rust crate tokio to 1.29.0

fix(deps): update rust crate clap to 4.3.8 fix(deps): update rust crate clap to 4.3.5 run cargo update [CI:BUILD] Packit: add Fedora downstream tasks fix(deps): update rust crate clap to 4.3.4 chore(deps): update dependency containers/automationimages to v20230614 fix(deps): update rust crate clap to 4.3.3 fix(deps): update rust crate log to 0.4.19 fix(deps): update rust crate clap to 4.3.2 fix(deps): update rust crate clap to 4.3.1 cirrus: remove verifyvendor task chore(deps): update dependency containers/automationimages to v20230601 fix(deps): update rust crate trust-dns-server to 0.22.1 chore(deps): update rust crate chrono to 0.4.26 fix(deps): update rust crate tokio to 1.28.2 fix(deps): update rust crate log to 0.4.18 chore(deps): update rust crate chrono to 0.4.25 fix(deps): update rust crate clap to 4.3.0 chore(deps): update dependency containers/automationimages to v20230517 fix(deps): update rust crate tokio to 1.28.1 chore(deps): update dependency containers/automationimages to v20230426 fix(deps): update rust crate clap to 4.2.7 fix(deps): update rust crate anyhow to 1.0.71 fix typo in makefile fix(deps): update rust crate tokio to 1.28.0 fix(deps): update rust crate clap to 4.2.5 fix(deps): update rust crate syslog to ^6.1.0 fix(deps): update rust crate clap to 4.2.4 fix(deps): update rust crate clap to 4.2.3 fix(deps): update rust crate clap to v4

chore(deps): update dependency containers/automationimages to v20230405

Changes in version 1.6.0:

fix(deps): update rust crate tokio to 1.27.0

use lower TTL for contianer entries fix(deps): update rust crate syslog to ^6.0.1 fix(deps): update rust crate futures-util to 0.3.28 chore(deps): update dependency containers/automationimages to v20230330 Disable Dependabot in favor of Renovate chore(deps): update dependency containers/automationimages to v20230320 build(deps): bump futures-util from 0.3.26 to 0.3.27 [CI:BUILD] Packit: trigger builds on commit to main branch build(deps): bump anyhow from 1.0.68 to 1.0.70 fix lint issue with new rust version 1.68 Cirrus: Update to newer CI VM images build(deps): bump chrono from 0.4.23 to 0.4.24 build(deps): bump libc from 0.2.139 to 0.2.140 build(deps): bump async-broadcast from 0.5.0 to 0.5.1 build(deps): bump signal-hook from 0.3.14 to 0.3.15 build(deps): bump futures-util from 0.3.25 to 0.3.26 build(deps): bump tokio from 1.25.0 to 1.26.0 [CI:DOCS] Clarify packit related comments [CI:BUILD] Packit: initial enablement Allow custom cargo binary path Switch to explicit platform list for cargo vendor-filterer Add renovate.json5 Cirrus: Groom rust cache before updating netavark was update to version 1.10.2 (jsc#PED-7577): Changes in version 1.10.2:

Fixed aardvark-dns handling

Do not perform network namespace detection on AV update

Changes in version 1.10.1:

Updated to nftables release 0.3 from crates.io

DISTROPACKAGE: fix incorrect vendored tar archive URL

Bump to 1.11.0-dev

Changes in version 1.10.0:

RPM: update .cargo/config before building

Added support for isolation to the nftables driver build(deps): bump h2 from 0.3.22 to 0.3.24 chore(deps): update rust crate chrono to 0.4.32 fix(deps): update rust crate envlogger to 0.11.0 chore(deps): update dependency containers/automationimages to v20240102 Bump nftables-rs to latest commit Netavark: nftables support fix(deps): update rust crate serdejson to 1.0.111 feat: added the --firewall-driver option Document how to generate a code coverage report for netavark fix(deps): update rust crate clap to ~4.4.12 fix(deps): update rust crate serdejson to 1.0.110 fix(deps): update rust-futures monorepo to 0.3.30 fix(deps): update rust crate nispor to 1.2.16 chore(deps): update rust crate tempfile to 3.9.0 Use tonic::transport::Uri instead of HTTP chore(deps): update dependency containers/automationimages to v20231208 fix(deps): update rust crate tokio to 1.35 dhcp-proxy: return actual error instead of generic one dhcp-proxy: skip set gateway if missing bump netlink-packet-route to 0.18.1 chore(deps): update rust crate oncecell to 1.19.0 fix(deps): update rust crate nispor to 1.2.15 fix(deps): update rust crate serde to 1.0.193 fix(deps): update rust crate clap to ~4.4.10 aardvark: show error if process is in wrong netns aardvark: remove unessesary unlock lockfile calls fix(deps): update rust crate url to 2.5.0

Bump working version to v1.10.0-dev

Changes in version 1.9.0:

test: fix syntax problem in helpers.bash

run cargo update use OsString/Path over String for file paths chore(deps): update dependency containers/automationimages to v20231116 firewalld-reload: fix CI tests firewalld-reload: prevent race which could leak fw rules fix(deps): update rust crate clap to ~4.4.8 CI: skip broken firewalld test fix(deps): update rust crate http to 0.2.11 rpm: add netavark-firewalld-reload.service to spec firewalld-reload: add integration tests firewall/state: make sure to ignore enoent on read firewall-reload: integrate actual logic to reload rules firewall/state: improve error messages firewall: add state functions to serialize configs firewalld: fix lint errors with rust v1.73 firewall: do not use full Network in NetworkStruct firewall: add dnsport to SetupNetwork add firewalld-reload subcommand fix(deps): update rust crate http to 0.2.10 fix(deps): update rust crate envlogger to 0.10.1 fix(deps): update rust crate tokio to 1.34 Update rust container build files bridge: force static mac on bridge interface fix(deps): update rust crate futures-core to 0.3.29 fix(deps): update rust crate serde to 1.0.190 fix(deps): update rust crate serdejson to 1.0.108 fix(deps): update rust crate sysctl to 0.5.5 fix(deps): update rust-futures monorepo to 0.3.29 CI: Drop CI VM distro name chore(deps): update dependency containers/automationimages to v20231004 fix(deps): update rust crate tokio to 1.33 build-sys: Filter to tier 2 Linux declaratively fix(deps): update rust crate sha2 to 0.10.8 fix podman.io community link

Bump to v1.9.0-dev

Changes in version 1.8.0:

run cargo update

Add vrf support for bridges Packit: switch to @containers/packit-build team for copr failure notification comments fix(deps): update rust crate nispor to 1.2.14 [CI:BUILD] Packit: tag @lsm5 on copr build failures chore(deps): update rust crate chrono to 0.4.31 fix(deps): update rust crate serdejson to 1.0.107 rust io safety: convert RawFd to BorrowedFd<> bump nix to 0.27.1 chore(deps): update rust crate chrono to 0.4.30 fix(deps): update rust crate serdejson to 1.0.106 chore(deps): update rust crate chrono to 0.4.29 fix(deps): update rust crate netlink-packet-route to 0.17.1 Bump tonic and prost Update container image to F38 Add ACCEPT rules in firewall for bridge network with internal dns. chore(deps): update rust crate tonic-build to 0.10 fix(deps): update rust crate nispor to 1.2.13 fix(deps): update rust crate serde to 1.0.188 Fix clippy warnings about formatting update chrono crate fix(deps): update rust crate url to 2.4.1 Add protoc dependency to README [CI:BUILD] rpm: spdx compatible license field fix(deps): update rust crate tokio to 1.32 chore(deps): update dependency containers/automationimages to v20230816 fix(deps): update rust crate serdejson to 1.0.105 fix(deps): update rust crate tokio to 1.31 fix(deps): update rust crate log to 0.4.20 run cargo update update tonic-build to 0.9.2 bump rust edition to 2021 iptables: drop invalid packages fix(deps): update rust crate tokio to 1.30 docs: Convert markdown with go-md2man instead of mandown fix(deps): update rust crate clap to 4.3.21 packit: Build PRs into default packit COPRs chore(deps): update dependency containers/automationimages to v20230807 fix(deps): update rust crate serde to 1.0.183 fix(deps): update rust crate serde to 1.0.181 fix(deps): update rust crate serde to 1.0.180 fix(deps): update rust crate serdejson to 1.0.104 fix(deps): update rust crate serde to 1.0.179 fix(deps): update rust crate serde to 1.0.176 fix(deps): update rust crate clap to 4.3.19 fix(deps): update rust crate serde to 1.0.175 fix(deps): update rust crate clap to 4.3.17 fix(deps): update rust crate clap to 4.3.15 fix(deps): update rust crate clap to 4.3.12 fix(deps): update rust crate serdejson to 1.0.103 [CI:BUILD] Packit: remove pre-sync action fix(deps): update rust crate serdejson to 1.0.102 fix(deps): update rust crate nispor to 1.2.12 macvlan: use netlink type for bclim bump netlink deps fix(deps): update rust crate serde to 1.0.171 fix(deps): update rust crate serde to 1.0.167 fix(deps): update rust crate clap to 4.3.11 fix(deps): update rust crate serde to 1.0.166 fix(deps): update rust crate serdejson to 1.0.100 iptables: improve error when ip6?tables commands are missing fix(deps): update rust crate clap to 4.3.10 fix(deps): update rust crate zbus to 3.14.1 [CI:BUILD] RPM: Fix ELN build and cleanup spec

bump to v1.8.0-dev

Changes in version 1.7.0:

fix(deps): update rust crate tokio to 1.29

netavark: make --config required for dns fix(deps): update rust crate serdejson to 1.0.99 fix(deps): update rust crate clap to 4.3.8 [CI:BUILD] Packit: add Fedora downstream tasks run cargo update fix(deps): update rust crate serdejson to 1.0.97 fix(deps): update rust crate sha2 to 0.10.7 fix(deps): update rust crate clap to 4.3.4 chore(deps): update dependency containers/automationimages to v20230614 fix(deps): update rust crate clap to 4.3.3 fix(deps): update rust crate log to 0.4.19 aardvark: fix missleading dns disabled log firewall: add NETAVARKISOLATION3 chain for strict isolation docs: fix link to getting started fix(deps): update rust crate serde to 1.0.164 netlink: fix incorrect info log for delroute dhcp-proxy: apply new ip address/gateway test-dhcp: fix broekn hasip() check dhcp-proxy: actually implement renewing leases dhcp-proxy: simplify code dhcp-proxy: drop macaddr dependency dhcp-proxy: remove some unused traits fix(deps): update rust crate zbus to 3.13.1 fix(deps): update rust crate clap to 4.3.2 chore(deps): update rust crate oncecell to 1.18.0 fix(deps): update rust crate url to 2.4.0 fix(deps): update rust crate clap to 4.3.1 chore(deps): update dependency containers/automationimages to v20230601 chore(deps): update rust crate chrono to 0.4.26 chore(deps): update rust crate chrono to 0.4.25 fix(deps): update rust crate log to 0.4.18 chore(deps): update rust crate oncecell to 1.17.2 macvlan: add bclim option parseoption(): return option instead of default add nodefaultgateway option fix(deps): update rust crate clap to 4.3.0 chore(deps): update dependency containers/automationimages to v20230517 fix(deps): update rust crate serde to 1.0.163 Add ability to add static route fix(deps): update rust crate serde to 1.0.162 Cirrus: Update fedora name to match image fix(deps): update rust crate clap to 4.2.7 chore(deps): update dependency containers/automationimages to v20230426 correct typo in Makefile simplify path printing fix(deps): update rust crate tokio to 1.28 aardvark-dns pid: return better errors fix comment in Subnet definition aardvark: no error when aardvark config is not there fix(deps): update rust crate zbus to 3.12.0 fix(deps): update rust crate clap to 4.2.4 fix(deps): update rust crate clap to 4.2.2 fix(deps): update rust crate serdejson to 1.0.96 update clap to v4 fix(deps): update rust crate serde to 1.0.160

bump to v1.7.0-dev

Changes in version 1.6.0:

dhcp-proxy: fix typo for --activity-timeout

chore(deps): update dependency containers/automationimages to v20230405 dhcp-proxy: use better error when connection fails add documentation for netavark plugins add stderr example plugin to test stderr passthrough add netavark plugin driver add example error plugin add host-device example plugin plugin: add simple plugin interface netlink: add dumpaddresses netlink: add setlinkns dhcp-proxy: correctly exit > 0 on errors fix(deps): update rust crate tonic to 0.9 fix(deps): update rust crate mozim to 0.2.2 fix(deps): update rust crate serde to 1.0.159 fix(deps): update rust crate netlink-sys to 0.8.5 dhcp-proxy: create socket directory only when used dhcp-proxy: do not remove socket when running under systemd Makefile: netavark-dhcp-proxy.service use correct path fix(deps): update rust crate http to 0.2.9 chore(deps): update rust crate oncecell to 1.17.1 fix(deps): update rust-futures monorepo to 0.3.28 fix(deps): update rust crate serdejson to 1.0.95 chore(deps): update dependency containers/automationimages to v20230330 Disable Dependabot in favor of Renovate chore(deps): update rust crate chrono to 0.4.24 build(deps): bump ipnet from 2.7.1 to 2.7.2 build(deps): bump serde from 1.0.158 to 1.0.159 build(deps): bump serdejson from 1.0.94 to 1.0.95 update,main: dont write empty space when no networkdnsservers is given fix(deps): update rust crate tokio to 1.27 Quit Leasing when Client disconnects build(deps): bump mozim from 0.2.1 to 0.2.2 iptables: fix incorrect debug statement build(deps): bump serde from 1.0.156 to 1.0.158 iptables: port fw handle wildcard address correctly chore(deps): update dependency containers/automationimages to v20230320 build(deps): bump zbus from 3.11.0 to 3.11.1 build(deps): bump anyhow from 1.0.69 to 1.0.70 [CI:BUILD] Packit: trigger builds on commit to main branch Cirrus: Invalidate v2 bin cache Include Systemd Files in RPM Package Cirrus: Fix success failing on artifact extraction fix lint issue with new rust version 1.68 Cirrus: Update to newer CI VM images build(deps): bump serde from 1.0.152 to 1.0.156 combine dhcp-proxy and netavark into one binary update: should allow empty networkdnsservers build(deps): bump libc from 0.2.139 to 0.2.140 fix aarch64 ncat flake update to mozim 0.2.1 build(deps): bump zbus from 3.10.0 to 3.11.0 packit: Update build release tag correctly test: move proto option into runnctest() test: add netns pid param to port checks test: import podman code to check for ports cirrus.yaml: add new binaries in artprepscript fix netavark-dhcp-proxy binary in system unit import netavark-proxy-dhcp tests add buildproxyclient target add netavark-dhcp-proxy to rpm Fix dhcp-proxy build Merge nv-dhcp-proxy into nv fix default route metric test name build(deps): bump tokio from 1.25.0 to 1.26.0 Support none parameter on NETAVARKFW build(deps): bump anyhow from 1.0.68 to 1.0.69 Fix typos update netlink-packet-{route,core} to 0.15 and 0.5 build(deps): bump serdejson from 1.0.92 to 1.0.93 build(deps): bump zbus from 3.8.0 to 3.10.0 [CI:BUILD] Packit: initial enablement Allow custom cargo binary path build(deps): bump serdejson from 1.0.91 to 1.0.92 Cirrus: Reduce requested CPUs for compile-tasks bump to version 1.0.6-dev build(deps): bump netlink-sys from 0.8.3 to 0.8.4

Add renovate.json5

Added aardvark-dns as dependency requirement for netavark

This update for nodejs20 fixes the following issues: Update to 20.11.1: (security updates) CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j CVE-2024-22017: setuid() does not drop all privileges due to iouring (bsc#1219995). CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998). CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: undici version 5.28.3 (bsc#1220017). CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to 20.11.0: esm: add import.meta.dirname and import.meta.filename fs: add c++ fast path for writeFileSync utf8 module: remove useCustomLoadersIfPresent flag module: bootstrap module loaders in shadow realm src: add --disable-warning option src: create per isolate proxy env template src: make process binding data weak stream: use Array for Readable buffer stream: optimize creation testrunner: adds built in lcov reporter testrunner: add Date to the supported mock APIs testrunner, cli: add --test-timeout flag Update to 20.10.0: --experimental-default-type flag to flip module defaults The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected. Added flush option in file system functions for fs.writeFile functions Added experimental WebSocket client vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script

This update for samba fixes the following issues: samba was updated to version 4.17.9: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). CVE-2023-3347: Fixed issue where SMB2 packet signing not enforced (bsc#1213170). CVE-2020-25720: Fixed issue where creating child permission allowed full write to all attributes (bsc#1213386). Bugfixes: Fixed trust relationship failure (bsc#1213384). Backported --pidl-developer fixes. Fixed smbdscavenger crash when service smbd is stopped. Fixed issue where vfsfruit might cause a failing open for delete. Fixed named crashes on DLZ zone update. Fixed issue where winbind recurses into itself via rpcdlsad. Fixed clilist looping 100% CPU against pre-lanman2 servers. Fixed smbclient leaks fds with showacls. Fixed aes256 smb3 encryption algorithms not allowed in smb3sidparse(). Fixed winbindd getting stuck on NTSTATUSRPCSECPKGERROR. Fixed smbget memory leak if failed to download files recursively. Fixed log flood: smbdcalculateaccessmaskfsp: Access denied: message level should be lower. Fixed floating point exception (FPE) via clipullsend at source3/libsmb/clireadwrite.c. Fixed testtstreammoretcpusertimeoutspin fails intermittently on Rackspace GitLab runners. Reduce flapping of ridalloc test. Fixed unreliable largeldap test. Fixed filename parser not checking veto files smb.conf parameter. Fixed mdssvc may crash when initializing. Fixed broken large directory optimization for non-lcomp path elements Fixed streamsdepot failing to create streams. Fixed shadowcopy2 and streamsdepot issues. Fixed wbinfo -u fails on ad dc with >1000 users. Fixed winbindd idmap child contacting the domain controller without a need. Fixed idmapautorid may fail to map sids of trusted domains for the first time. Fixed idmaphash doesn't use IDTYPEBOTH for reverse mappings. Fixed net ads search -P doesn't work against servers in other domains. Fixed DS ACEs might be inherited to unrelated object classes. Fixed temporary smbXsrvtconglobal.tdb can't be parsed. Fixed setting veto files = /./ breaking listing directories (bsc#1212375). Fixed dsgetdcname assuming local system uses IPv4.

This update for duktape fixes the following issues: Ship libduktape206-32bit: needed by libproxy since version 0.5.

This update for libqt5-qtbase fixes the following issues: CVE-2023-32763: Fixed an overflow in QTextLayout (bsc#1211798).

This update for grub2 fixes the following issues: Fix PowerPC grub slow loading time (bsc#1217102)

This update for pacemaker fixes the following issues: libcrmcommon: Avoid file descriptor leak in IPC client with async connection (bsc#1219323) libcrmcommon: Always output request= in XML output libcrmcommon: crmxmlescape() shouldn't stop on Unicode characters tools: crmattribute emits garbage for --node localhost or auto tools: Fix memory leak in crmmon with HTML output tools: crmmon segfaults when fencer connection is lost (bsc#1219220) attrd: Write Pacemaker Remote node attributes even if not in cache agents: Use attrdupdater dampen delay in SysInfo libcrmcommon: Check correct env vars in pcmknodeattrtarget() scheduler: Restore nvpair behavior without id-ref scheduler: Reject expression without op sooner libcrmcommon: Fix NULL dereference in expandidref() scheduler: Improve logs for invalid id-ref's pacemaker-attrd,libcrmcluster: Avoid use-after-free when remote node in cluster node cache libcrmcluster: Avoid use-after-free in trace log HealthSmart: Check the parameter values of checktemperature to avoid error output agents: Handle dampening parameter consistently and correctly crmresource: Make --wait wait for pending actions in CIB scheduler: Avoid double free with disabled recurring actions agents: HealthCPU - fix the validation of input controller: Don't try to execute agent action at shutdown tools: The dampen parameter is disabled when setting values with attrdupdater.

This update for rust fixes the following issues: Update to version 1.76.0 - for details see the rust1.76 package Version 1.76.0 (2024-02-08)

This update for bind fixes the following issues: Update to release 9.16.48: CVE-2023-50387: Fixed a denial-of-service caused by DNS messages containing a lot of DNSSEC signatures (bsc#1219823). CVE-2023-50868: Fixed a denial-of-service caused by NSEC3 closest encloser proof (bsc#1219826). CVE-2023-4408: Fixed a denial-of-service caused by DNS messages with many different names (bsc#1219851). CVE-2023-5517: Fixed a possible crash when nxdomain-redirect was enabled (bsc#1219852). CVE-2023-5679: Fixed a possible crash when bad interaction between DNS64 and serve-stale, when both of these features are enabled (bsc#1219853). CVE-2023-6516: Fixed excessive memory consumption when continuously trigger the cache database maintenance (bsc#1219854).

This update for openblas contains the following fixes: Added libopenblaspthreads0 to Package Hub SLE-15-SP5 for architecture s390 (no source changes) (bsc#1217608)

This update for fence-agents fixes the following issue: Update fence-agents package with fenceaws and fenceibmpowervs (jsc#PED-7701)

This update for conmon fixes the following issues: New upstream release 2.1.10 Bug fixes: Fix incorrect free in connsock

logging: Respect log-size-max immediately after open

New upstream release 2.1.9 Bug fixes: fix some issues flagged by SAST scan src: fix write after end of buffer src: open all files with OCLOEXEC oom-score: restore oom score before running exit command Features: Forward more messages on the sd-notify socket

logging: -l passthrough accepts TTYs

[bsc#1215806] Update to version 2.1.8: stdio: ignore EIO for terminals (bsc#1217773) ensure console socket buffers are properly sized conmon: drop return after pexit() ctrl: make accept4 failures fatal logging: avoid opening /dev/null for each write oom: restore old OOM score Use default umask 0022 cli: log parsing errors to stderr Changes to build conmon for riscv64 Changes to build conmon for ppc64le Fix closeotherfds on FreeBSD

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for yast2-packager fixes the following issues: After installation disable the empty installation repository from the SLE15 Online medium (bsc#1182303) Aditional fixes to avoid Yast failures in SLE 15 SP5 Maintenance updates (bsc#1219174)

This update for grub2 fixes the following issues: Fix missing grub2 exporters on Leap

This update for pdsh fixes the following issues: pdsh was updated to version 2.35 (jsc#PED-7817, jsc#PED-7829):

Added -d option to log errors

Added -k option to fail fast on ssh failures or non-zero return code build: use LDADD instead of LDFLAGS for libcommon.la dsbak: fixed handling of empty input lines Release a lock that is no longer used slurm: add -C to restrict hostlist to nodes with features slurm: call slurminit() once before any call to Slurm API slurm: fix compile of slurm plugin against Slurm >= 23.x

ssh: fixed sshcmdsignal on macos

Fixed missing pdsh-slurm options to run jobs against the slurm cluster (bsc#1212946)

Removed outdated and defunct project URI on Google: The content can still be found in the archives at: https://code.google.com/archive/p/pdsh/. The project has moved to github entirely.

This update for podman fixes the following issues: Update to version 4.8.3: Update RELEASENOTES.md update module golang.org/x/crypto [security]

Error on HyperV VM start when gvproxy has failed to start

Refactor network backend dependencies:

podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. This fixes missing cni-plugins in some scenarios

Default to netavark everywhere where it's available

Update to version 4.8.2:

Update RELEASENOTES.md Kube Play - set ReportWriter when building an image

Fix user-mode net init flag on first time install

Default to the new networking backend, netavark, on openSUSE (bsc#1217828)

Update to version 4.8.1:

Handle symlinks when checking DB vs runtime configs libpod: Detect whether we have a private UTS namespace on FreeBSD pkg/bindings: add new APIVersionError error type fix podman-remote exec regression with v4.8 sqlite: fix issue in ValidateDBConfig() sqlite: fix missing Commit() in RemovePodContainers() sqlite: set busy timeout to 100s Fix locking error in WSL machine rm -f Gating test fixes If API calls for kube play --replace, then replace pod

Fix wsl.conf generation when user-mode-networking is disabled

Update to version 4.8.0:

Bump to Buildah v1.33.2 [CI:DOCS] Update release notes machine applehv: create better error on start failure Cirrus: Update operating branch rootlesstutorial: modernize Update to libhvee 0.5.0 vmtypes names cannot be used as machine names Add support for --compat-auth-file in login/logout Update tests for a c/common error message change Update c/image and c/common to latest, c/buildah to main CI: test overlay and vfs [CI:DOCS] Add link to podman py docs Test fixes for debian pasta tests: remove some skips VM images: bump to 2023-11-16 fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] [CI:DOCS] Machine test timeout env var Quadlet - add support for UID and GID Mapping Quadlet - Allow using symlink on the base search paths [skip-ci] Update dessant/lock-threads action to v5 Avoid empty SSH keys on applehv qemu,parseUSB: minor refactor fix(deps): update module github.com/gorilla/handlers to v1.5.2 docs: fix relabeling command Pass secrets from the host down to internal podman containers (Temporary) Emergency CI fix: quay search is broken Update podman-stats.1.md.in [CI:BUILD] packit: handle builds for RC releases Quadlet test - add case for multi = sign in mount set RLIMITNOFILE soft limit to match the hard limit on mac rootless: use functionalities from c/storage CI: e2e: fix a smattering of test bugs that slipped in fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 vendor: update c/storage Improve the documentation of quadlet Fix socket mapping socket mapping nits fix(deps): update module golang.org/x/tools to v0.15.0 fix(deps): update github.com/containers/libhvee digest to 9651e31 [skip-ci] Update github/issue-labeler action to v3.3 Document --userns=auto behaviour for rootless users machine: qemu: add usb host passthrough fix(deps): update module golang.org/x/net to v0.18.0 fix(deps): update module github.com/onsi/gomega to v1.30.0 Refactor Ignition configuration for virt providers [CI:BUILD] rpm: disable GOPROXY Automatic code cleanups [JetBrains] Refactor key machine objects systests: add [NNN] prefix in logs, NNN = filename systests: add a last-minute check for db backend applehv: allow virtiofs to mount to root Run codespell on podman update completion scripts for cobra v1.8.0 Fix man page display of podman-kube-generate Try to fix the broken formatting of man podman-kube-apply(1). fix(deps): update module golang.org/x/text to v0.14.0 docs: make CNI removal explicit fix(deps): update module github.com/gorilla/mux to v1.8.1 fix(deps): update module github.com/spf13/cobra to v1.8.0 fix(deps): update module golang.org/x/sync to v0.5.0 fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 Podman push --help should reveal default compression Update container-device-interface (CDI) to v0.6.2 fix: adjust helper string in machinecommon fix: adjust helper string in machinecommon remote,test: remove .dockerignore which is a symlink [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 fix: adjust helper string in machinecommon vendor: update github.com/coreos/go-systemd/v22 to latest main CI: default to sqlite vendor: update c/common check system connections before machine init Consume OCI images for machine image freebsd: drop dead code libpod: make removePodCgroup linux specific containers: drop special handling for ErrCgroupV1Rootless compose: fix compose provider debug message image: replace GetStoreImage with ResolveReference vendor: bump c/image to 373c52a9466f Refactor machine socket mapping AppleHV: Fix machine rm error message Add status messages to podman --remote commit End-of-Life policy for github issues fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 Support passing of Ulimits as -1 to mean max fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 fix(deps): update github.com/crc-org/vfkit digest to f3c783d Log gvproxy and server9 to file on log-level=debug Change to using gopsutil for cross-OS process ops Initial addition of 9p code to Podman libpod: fix /etc/hostname with --uts=host systests: stty test: retry once on flake systests: pasta: avoid hangs Fix secrets scanning GHA Workflow [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 docs: clarify systemd cgroup mount podman build --remote URI Dockerfile shoud not be treated as file Small fixes for wacko CI environments Do not add powercap mask if no paths are masked compose: try all possible providers before throwing an error podman kube play --replace should force removal of pods and containers Sort kube options alphabetically container.conf: support attributed string slices CI: podman farm tests cleanup Mask /sys/devices/virtual/powercap Update module github.com/google/uuid to v1.4.0 fix(deps): update module github.com/docker/docker to v24.0.7+incompatible fix(deps): update module go.etcd.io/bbolt to v1.3.8 CI: systest: safer randomrfc1918subnet CI: e2e: safer GetPort() Fix broken code block markup in Introduction.rst chore(deps): update module google.golang.org/grpc to v1.57.1 [security] chore: remove npipe const and use vmtype const for checking Update module github.com/onsi/gomega to v1.29.0 CI: try to fix more networking flakes fix: check wsl npipe when executing podman compose [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 Quadlet - explicit support for read-only-tmpfs compat API: fix image-prune --all Makefile - allow more control over Ginkgo parameters Add e2e tests for farm build vendor c/{buildah,common}: appendable containers.conf strings, Part 1 Add podman farm build command Add emulation package Use buildah default isolation when working with podman play kube docs(API): Fix compat network (dis-)connect test/e2e: do not import buildah pkg/specgen: remove configunsupported.go pkg/parallel/ctr: add !remote tag pkg/domain/filters: add !remote tag pkg/ps: add !remote tag pkg/systemd/generate: add !remote tag libpod: add !remote tag pkg/autoupdate: add !remote tag vendor latest c/common libpod: remove build support non linux/freebsd Fix typo test/apiv2: adapt apiv2 test on cgroups v1 environment ginkgo setup: retry cache pulls Support size option when creating tmpfs volumes not mounted layers should be reported as info not error CI: stop using registry.k8s.io fix(deps): update module github.com/vbatts/git-validation to v1.2.1 test fixes for c/common tag chnages vendor latest c/common hyperV: Update lastUp time [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 lint: disable testifylint lint: fix warnings found by perfsprint lint: fix warnings found by inamedparam lint: fix warnings found by protogetter libpod: skip DBUSSESSIONBUSADDRESS in conmon Use node hostname in kube play when hostNetwork=true cirrus setup: special-case perl unicode network: document ports and macvlan interaction quadlet: document cgroupv2 requirement [skip-ci] Update actions/checkout digest to b4ffde6 Revert "Emergency workaround for CI breakage" remote: exec: do not leak session IDs on errors fix(deps): update github.com/containers/storage digest to 79aa304 fix(deps): update module k8s.io/kubernetes to v1.28.3 System tests: fix broken silence127 Add TERM iff TERM not defined in container when podman exec -t Emergency workaround for CI breakage Kill gvproxy when machine rm -f Fix path for omvf vars on Darwin/arm64 Allow systemd specifiers in User and Group Quadlet keys libpod: rename confusing import name use FindInitBinary() for init binary vendor latest c/common exec: do not leak session IDs on errors systests: cp test: lots of cleanup Define better error message for container name conflicts with external storage. Quadlet - support ImageName for .image files test/system: ignore 127 if it is the expected rc test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 image history: fix walking layers fix(api): Ensure compatibality for network connect [CI:DOCS] Add cross-build target info. machine set: document --rootful better libpod: restart+userns cleanup netns correctly Minor log and doc fixes Quadlet man page - discuss volume removal explicitly Quadlet - add support for KubeDownForce System Test - Quadlet kube oneshot Fix output of podman --remote top buildah-bud: test relative TMPDIR Fix handling of --read-only-tmpfs flag Vendor common and buildah main remote,build: wire unsetlabels test: build with TMPDIR as relative docs: add unsetlabel vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 fix: pull error response docker rest api compatibility Show client info even if remote connection fails fix(deps): update github.com/containers/libhvee digest to e51be96 Run codespell SetLock for all virt providers Machine: Teardown on init failure healthcheck: make sure to always show healthstatus events Apply suggestions from code review [CI:DOCS]rtd: implement v2 build file Quadlet - support oneshot .kube files libpod: fix deadlock while parallel container create fix(deps): update module golang.org/x/net to v0.17.0 api: add compatMode paramenter to libpod's pull endpoint api: break out compat image pull fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 use sqlite as default database vendor latest c/common fix(deps): update module github.com/nxadm/tail to v1.4.11 Check for image with /libpod/containers/create container: always check if mountpoint is mounted fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 vendor: update c/storage api: drop debug statement Quadlet - add support for global arguments Add system test fix(deps): update module golang.org/x/tools to v0.14.0 Don't ignore containerfiles outside of build context fix(deps): update github.com/containers/libhvee digest to fcf1cc2 fix(deps): update module golang.org/x/term to v0.13.0 Update module golang.org/x/sys to v0.13.0 [CI:DOCS] Add updating version on podman.io to release process containers.conf: add privileged field to containers table Implement secrets/credential scanning Cirrus: Execute Windows podman-machine e2e tests vendor: bump c/storage Update module golang.org/x/sync to v0.4.0 [CI:DOCS] update swagger version on docs.podman.io Create Qemu command wrapper Adjust to path name change for resolved unit Revert "Fix WSL systemd detection" [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL [CI:DOCS] update kube play delete endpoint docs [CI:DOCS] Remove dead link from README test/system: --env-file test fixes Revert "feat(env): support multiline in env-file" Revert "docs(env-file): improve document description" Revert "fix(env): parsing --env incorrect in cli" Filter healthcheck and exec events for logging in console inspect: ignore ENOENT during device lookup test, manifest: test push retry Fix locale issues with WSL version detection vendor: update module github.com/docker/distribution to v2.8.3+incompatible vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 Update github.com/containers/libhvee digest to e9b1811 windows: Use prebuilt gvproxy/win-sshproxy binaries Volume create - fast exit when ignore is set and volume exists Update golang.org/x/exp digest to 9212866 Update github.com/opencontainers/runtime-spec digest to c0e9043 remove selinux tag as not needed anymore [skip-ci] Improve podmansh(1) Build applehv for Intel Macs Revert "GHA Workflow: Faster discussion-locking" update vfkit vendored code Add DefaultMode to kube play Fix broken podman images filters Remove c.ExtraFiles line in machine podman: run --replace prints only the new container id New machines should show Never as LastUp podman machine: disable zincati update service Revert "cirrus setup: install enUS.UTF-8 locale" Cirrus: CI VM images w/ newer automation-library CI VMs: bump to f39 + f38 [CI:DOCS] Update podman load doc Update mac installer to latest gvproxy release Fix WSL systemd detection Add documentation for the vrf option on netavark fix(deps): update github.com/containers/common digest to 9342cdd fix: typos in links, path and code example e2e: ExitCleanly(): manual special cases e2e: ExitCleanly(): the final fron^Wcommit [CI:DOCS] Add win-sshproxy target to winmake wsl: enable machine init tests Update docs/source/markdown/options/rdt-class.md move IntelRdtClosID to HostConfig use default when user does not provide rdt-class Add documentation for Intel RDT support Add test for Intel RDT support Add Intel RDT support [CI:DOCS] Fix podman form update --help examples Quadlet container mount - support non key=val options test/e2e: default to netavark [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 fix(deps): update github.com/containers/common digest to 4619314 applehv: enable machine tests for start applehv: machine tests for stop and rm Update machine tests README Add podman socket info to machine inspect Fix podman machine info test for hyperV libpod: pass entire environment to conmon e2e: ExitCleanly(): manual fixes to get tests working e2e: ExitCleanly(): a few more FCOS+podman-next: correct GHA conditional syntax pkg/machine/e2e: wsl stop wsl: machine tests for inspect wsl: machine tests for ssh fix(deps): update github.com/containers/common digest to e18cda8 wsl: machine start test wsl machine tests: set wsl: machine tests Skip proxy test for hyperV Enable machine e2e test for applehv hyperV: Respect rootful option on machine init [CI:BUILD] FCOS image: enable nightly build e2e: use safe fedora-minimal image hyperv: machine e2e tests for set command podman build: correct default pull policy fix handling of static/volume dir unbreak CI: useradd not found hyperv: set more realistic starting state hyperv: use StopWithForce with remove Fix all ports exposed by kube play Fix setting timezone on HyperV fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 Fix farm update to check for connections Adjust machine CPU tests Bump version on main [CI:BUILD] Packit: show SHORTSHA in podman --version for COPR builds Vendor c/common pod rm: do not log error if anonymous volume is still used e2e: ExitCleanly(): manual fixes to get tests passing e2e: ExitCleanly(): a few more fixes for pkg/machine/e2e on hyperv test: fix rootless propagation test [CI:BUILD] packit: tag @containers/packit-build team on copr build failures Enable disk resizing for applehv Various updates for hyperv and machine e2e tests test: update fedoraMinimal version specgen, rootless: fix mount of cgroup without a netns Automatically remove anonymous volumes when removing a container Use ActiveServiceDestination in ssh remoteConnectionUsername fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 e2e: ExitCleanly(): generatekubetest.go e2e: generate kube -> kube generate e2e: ExitCleanly(): generatekubetest.go windows cannot "do" extra files e2e: ExitCleanly(): Fixes for breaking tests play kube -> kube play e2e: ExitCleanly(): playkubetest.go introduce pkg/strongunits Makefile equiv Powershell script pass --syslog to the cleanup process vendor of containers/common fix --authfile auto-update test compat API: speed up network list Change priority for cli-flags for remotely operating Podman libpod: remove unused ContainerState() fucntion [CI:BUILD] Packit: Enable failure notifications for cockpit tests e2e: ExitCleanly(): more low-hanging fruit e2e: ExitCleanly(): more low-hanging fruit fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 Enable machine e2e tests for WSL systests: tighter checks for unwanted warnings GHA Workflow: Faster discussion-locking [CI:BUILD] FCOS + podman-next image: pull in wasm [CI:BUILD] rpm: remove gvproxy subpackage [CI:DOCS] Tweak podman to Podman in a few farm man pages Docs on sig-proxy are wrong, we support TTY e2e: ExitCleanly(): low-hanging fruit, part 2 e2e: ExitCleanly(): low-hanging fruit, part 1 Buildtag out unix commands for common OS files systests: clean up after tests; fix missing path in logs [CI:BUILD] followup PR for fcos with podman-next Implement gvproxy networking using cmdline wrapper fix, test: rmi should work with images w/o layers vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 Quadlet Image test - rearrange test function e2e: continuing ExitCleanly() work: manual tweaks e2e: continuing ExitCleanly() work [CI:DOCS] Improve podman-tag man page [CI:DOCS] Improve podman-build man page [CI:DOCS] Include precheck to release process [CI:DOCS] consistentize filter options in man pages Quadlet - add support for .image units --env-host: use default from containers.conf error when --module is specified on the command level man page crossrefs: add --filter autocompletes Fix specification of unix:///run Add label! filter and tests to containers and pods Add test for legacy address without two slashes

Use url with scheme and path for the unix address

Use crun only on selected archs

This recommended update for qt6-declarative, qt6-languageserver fixes the following issues: Add missing dependencies of qt6-declarative-tools to Package Hub for SLE-15 SP5 (bsc#1219182)

This update for pacemaker fixes the following issues: libcrmcommon: wait for reply from appropriate controller commands (bsc#1218312, rh#2225631, rh#2221084) attrd: don't start a new election when receiving a client update (bsc#1215446)

This update for multipath-tools fixes the following issues: Fixed ANA prioritizer enablement logic (bsc#1218326)

This update for util-linux fixes the following issues: Fix performance degradation (bsc#1207987)

This update for libqt5-qtlocation and qt6-qt5compat fixes the following issue: rebuild against the newer icu 73 library.

This update for xorg-x11-server fixes the following issues: CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846)

This update for suse-module-tools fixes the following issues: Update to version 15.5.4 Add symlink /boot/.vmlinuz.hmac (bsc#1217775)

This update for sssd fixes the following issues: Update shadowLastChanged attribute during LDAP password change (bsc#1218537)